Skip to content

Commit cc653c1

Browse files
loic-sharmaloic-sharma
authored
Merge pull request #8852 from NuGet/dev
[ReleasePrep][2021.10.15]RI of dev into main
2 parents 790313d + bbe3f51 commit cc653c1

10 files changed

Lines changed: 172 additions & 87 deletions

File tree

‎src/NuGetGallery.Services/Authentication/ApiKeyV4.cs‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,16 @@ private bool TryParseInternal(string plaintextApiKey)
121121
try
122122
{
123123
var id = plaintextApiKey.Substring(0, IdPartBase32Length);
124-
var idBytes = id.AppendBase32Padding().ToUpper().FromBase32String();
124+
var validId = id
125+
.AppendBase32Padding()
126+
.ToUpper()
127+
.TryDecodeBase32String(out var idBytes);
128+
129+
if (!validId)
130+
{
131+
return false;
132+
}
133+
125134
bool success = idBytes[0] == IdPrefix[0] && idBytes[1] == IdPrefix[1];
126135

127136
if (success)

‎src/NuGetGallery.Services/Extensions/Base32Encoder.cs‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,20 @@ public static string ToBase32String(this byte[] data)
1818
return Encode(data);
1919
}
2020

21+
public static bool TryDecodeBase32String(this string base32String, out byte[] result)
22+
{
23+
try
24+
{
25+
result = Decode(base32String);
26+
return true;
27+
}
28+
catch (ArgumentException)
29+
{
30+
result = Array.Empty<byte>();
31+
return false;
32+
}
33+
}
34+
2135
public static byte[] FromBase32String(this string base32String)
2236
{
2337
return Decode(base32String);
@@ -42,7 +56,7 @@ public static string Encode(byte[] data)
4256
{
4357
if (data == null)
4458
{
45-
throw new NullReferenceException(nameof(data));
59+
throw new ArgumentNullException(nameof(data));
4660
}
4761

4862
int ncTokens = GetTokenCount(data);
@@ -63,7 +77,7 @@ public static byte[] Decode(string base32String)
6377
{
6478
if (base32String == null)
6579
{
66-
throw new NullReferenceException(nameof(base32String));
80+
throw new ArgumentNullException(nameof(base32String));
6781
}
6882

6983
// Validate base32 format

‎src/NuGetGallery.Services/Models/ReportPackageReason.cs‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,19 +10,22 @@ public enum ReportPackageReason
1010
[Description("Other")]
1111
Other,
1212

13-
[Description("The package has a bug/failed to install")]
13+
[Description("A bug/failed to install")]
1414
HasABugOrFailedToInstall,
1515

16-
[Description("The package contains malicious code")]
16+
[Description("Malicious code")]
1717
ContainsMaliciousCode,
1818

19-
[Description("The package is infringing my copyright or trademark")]
19+
[Description("A security vulnerability")]
20+
ContainsSecurityVulnerability,
21+
22+
[Description("Content infringing my copyright or trademark")]
2023
ViolatesALicenseIOwn,
2124

22-
[Description("The package contains private/confidential data")]
25+
[Description("Private/confidential data")]
2326
ContainsPrivateAndConfidentialData,
2427

25-
[Description("The package was not intended to be published publicly on nuget.org")]
28+
[Description("Content not intended to be published publicly on nuget.org")]
2629
ReleasedInPublicByAccident,
2730

2831
[Description("Child sexual exploitation or abuse")]
@@ -31,13 +34,13 @@ public enum ReportPackageReason
3134
[Description("Terrorism or violent extremism")]
3235
TerrorismOrViolentExtremism,
3336

34-
[Description("The package contains hate speech")]
37+
[Description("Hate speech")]
3538
HateSpeech,
3639

37-
[Description("The package contains content related to imminent harm")]
40+
[Description("Content related to imminent harm")]
3841
ImminentHarm,
3942

40-
[Description("The package contains non-consensual intimate imagery (i.e. \"revenge porn\")")]
43+
[Description("Non-consensual intimate imagery (i.e. \"revenge porn\")")]
4144
RevengePorn,
4245

4346
[Description("Other nudity or pornography (not \"revenge porn\")")]

‎src/NuGetGallery/Controllers/PackagesController.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ public partial class PackagesController
6363
{
6464
ReportPackageReason.ViolatesALicenseIOwn,
6565
ReportPackageReason.ContainsMaliciousCode,
66+
ReportPackageReason.ContainsSecurityVulnerability,
6667
ReportPackageReason.HasABugOrFailedToInstall,
6768
ReportPackageReason.Other
6869
};
@@ -71,6 +72,7 @@ public partial class PackagesController
7172
{
7273
ReportPackageReason.ViolatesALicenseIOwn,
7374
ReportPackageReason.ContainsMaliciousCode,
75+
ReportPackageReason.ContainsSecurityVulnerability,
7476
ReportPackageReason.HasABugOrFailedToInstall,
7577
ReportPackageReason.ChildSexualExploitationOrAbuse,
7678
ReportPackageReason.TerrorismOrViolentExtremism,

‎src/NuGetGallery/Controllers/UsersController.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -624,6 +624,7 @@ public virtual ActionResult ForgotPassword()
624624

625625
[HttpPost]
626626
[ValidateAntiForgeryToken]
627+
[ValidateRecaptchaResponse]
627628
public virtual async Task<ActionResult> ForgotPassword(ForgotPasswordViewModel model)
628629
{
629630
// We don't want Login to have us as a return URL

‎src/NuGetGallery/ViewModels/ReportViewModel.cs‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,8 @@ public abstract class ReportViewModel : IPackageVersionModel
1313

1414
public string PackageVersion { get; set; }
1515

16-
[NotEqual(ReportPackageReason.HasABugOrFailedToInstall, ErrorMessage = "Unfortunately we cannot provide support for bugs in NuGet Packages. Please contact owner(s) for assistance.")]
17-
[Required(ErrorMessage = "You must select a reason for reporting the package.")]
1816
[Display(Name = "Reason")]
17+
[Required(ErrorMessage = "You must select a reason for reporting the package.")]
1918
public ReportPackageReason? Reason { get; set; }
2019

2120
[Display(Name = "Send me a copy")]

‎src/NuGetGallery/Views/Packages/ReportAbuse.cshtml‎

Lines changed: 56 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
@model ReportAbuseViewModel
22
@{
3-
ViewBag.Title = "Report Abuse by " + Model.PackageId + " " + Model.PackageVersion;
3+
ViewBag.Title = "Report Package " + Model.PackageId + " " + Model.PackageVersion;
44
ViewBag.MdPageColumns = GalleryConstants.ColumnsFormMd;
55
string returnUrl = ViewData.ContainsKey(GalleryConstants.ReturnUrlViewDataKey) ? (string)ViewData[GalleryConstants.ReturnUrlViewDataKey] : Request.RawUrl;
66
}
@@ -9,44 +9,68 @@
99
<div class="row report-form">
1010
<div class="@ViewHelpers.GetColumnClasses(ViewBag)">
1111
@Html.Partial(
12-
"_PackageHeading",
12+
"_PackageHeading",
1313
new PackageHeadingModel(
14-
Model.PackageId,
15-
Model.PackageVersion,
16-
"Report abuse"))
14+
Model.PackageId,
15+
Model.PackageVersion,
16+
"Report package"))
1717

18+
<h2><strong>If this package has a bug/failed to install</strong></h2>
1819
@ViewHelpers.AlertWarning(isAlertRole: true, htmlContent:
1920
@<text>
20-
<strong>Important - Please do not use this form to report a bug in a package you are using!</strong><br />
21-
This form is for reporting abusive packages such as
22-
packages containing malicious code or spam. If "@Model.PackageId" simply doesn't
23-
work, or if you need help getting the package installed, please
21+
Please do not report using the form below - that is reserved for abusive packages, such as those containing malicious code or spam.
22+
<br />
23+
<br />
24+
If "@Model.PackageId" simply doesn't work, or if you need help getting the package installed, please
2425
<a href="@Url.ContactOwners(Model)" title="contact the owners">contact the owners instead.</a>
2526
</text>
2627
)
2728

28-
<p tabindex="0">
29-
Please provide a detailed abuse report with evidence to support your claim! We cannot delete packages without evidence that they exhibit malicious behavior.
30-
</p>
29+
<h2><strong>To report a security vulnerability</strong></h2>
30+
@ViewHelpers.AlertWarning(isAlertRole: true, htmlContent:
31+
@<text>
32+
Please report security vulnerabilities through the <a href="https://msrc.microsoft.com/create-report" title="report a security vulnerability">official portal</a>.
33+
If this is not a Microsoft - owned package, consider also <a href="@Url.ContactOwners(Model)" title="contact the owners">contacting the owners</a>.
34+
</text>
35+
)
3136

37+
<h2><strong>To report abuse, use this form</strong></h2>
3238
@if (!Model.ConfirmedUser)
3339
{
34-
<p tabindex="0">
35-
Note: If this is your package and you would like to contact support, please
36-
<a href="@Url.LogOn(returnUrl)">sign in.</a>
37-
</p>
40+
@ViewHelpers.AlertWarning(isAlertRole: true, htmlContent:
41+
@<text>
42+
If this is your package, please <a href="@Url.LogOn(returnUrl)">sign in</a> to contact support.
43+
</text>
44+
)
3845
}
46+
<p tabindex="0">
47+
<text>
48+
Please provide a detailed abuse report with evidence to support your claim! We cannot delete packages without evidence that they exhibit malicious behavior.
49+
</text>
50+
</p>
51+
3952
@using (Html.BeginForm())
4053
{
4154
@Html.AntiForgeryToken()
4255

4356
<div id="form-field-reason" class="form-group @Html.HasErrorFor(m => m.Reason)">
4457
@Html.ShowLabelFor(m => m.Reason)
45-
<p tabindex="0">Please select the reason for contacting support about this package.</p>
58+
<p tabindex="0">Please select the reason for contacting support about this package. This package contains:</p>
4659
@Html.ShowEnumDropDownListFor(m => m.Reason, Model.ReasonChoices, "<Choose a Reason>")
4760
@Html.ShowValidationMessagesFor(m => m.Reason)
4861
</div>
4962

63+
<div class="reason-error-has-a-bug" tabindex="0">
64+
<p>
65+
Unfortunately we cannot provide support for bugs in NuGet packages. Please <a href="@Url.ContactOwners(Model)" title="contact the owners">contact the owners</a> for assistance.
66+
</p>
67+
</div>
68+
<div class="reason-error-security-vulnerability" tabindex="0">
69+
<p>
70+
Please report security vulnerabilities through the <a href="https://msrc.microsoft.com/create-report" title="report a security vulnerability">official portal</a>.
71+
If this is not a Microsoft - owned package, consider also <a href="@Url.ContactOwners(Model)" title="contact the owners">contacting the owners</a>.
72+
</p>
73+
</div>
5074
<div id="report-abuse-form">
5175
<div class="form-group @Html.HasErrorFor(m => m.Email)">
5276
@Html.ShowLabelFor(m => m.Email)
@@ -73,11 +97,6 @@
7397
Note: Please complete this form and submit it so we can proceed with an appropriate response regarding the NuGet package (e.g. removing it). In addition, please proceed to <a href="https://report.cybertip.org">https://report.cybertip.org</a> to report the matter in more detail.
7498
</p>
7599
</div>
76-
<div class="terrorism-or-violent-extremism" tabindex="0">
77-
<p>
78-
Note: Please complete this form and submit it so we can proceed with an appropriate response regarding the NuGet package (e.g. removing it). In addition, please proceed to <a href="https://www.microsoft.com/en-au/concern/terroristcontent">https://www.microsoft.com/en-au/concern/terroristcontent</a> to report the matter in more detail.
79-
</p>
80-
</div>
81100
<div class="imminent-harm" tabindex="0">
82101
<p>
83102
Note: please ensure when reporting this type of abuse that you've considered whether the following are present:
@@ -89,11 +108,6 @@
89108
</ul>
90109
</p>
91110
</div>
92-
<div class="revenge-porn" tabindex="0">
93-
<p>
94-
Note: Please complete this form and submit it so we can proceed with an appropriate response regarding the NuGet package (e.g. removing it). In addition, please proceed to <a href="https://www.microsoft.com/en-us/concern/revengeporn">https://www.microsoft.com/en-us/concern/revengeporn</a> to report the matter in more detail.
95-
</p>
96-
</div>
97111
@Html.ShowTextAreaFor(m => m.Message, 10, 50)
98112
@Html.ShowValidationMessagesFor(m => m.Message)
99113
</div>
@@ -139,12 +153,26 @@
139153
$form.validate().element($('#Reason'));
140154
}
141155
142-
if (val === 'HasABugOrFailedToInstall') {
156+
// For error conditions, hide the other form fields and show error messages
157+
if (val === 'HasABugOrFailedToInstall'
158+
|| val === 'ContainsSecurityVulnerability') {
143159
$('#report-abuse-form').hide();
144160
} else {
145161
$('#report-abuse-form').show();
146162
}
147163
164+
if (val === 'HasABugOrFailedToInstall') {
165+
$form.find('.reason-error-has-a-bug').show();
166+
} else {
167+
$form.find('.reason-error-has-a-bug').hide();
168+
}
169+
170+
if (val === 'ContainsSecurityVulnerability') {
171+
$form.find('.reason-error-security-vulnerability').show();
172+
} else {
173+
$form.find('.reason-error-security-vulnerability').hide();
174+
}
175+
148176
// We don't suggest the customer contact the owner in the case of safety violations
149177
if (val === 'ChildSexualExploitationOrAbuse'
150178
|| val === 'TerrorismOrViolentExtremism'
@@ -163,24 +191,12 @@
163191
$form.find('.child-sexual-exploitation').hide();
164192
}
165193
166-
if (val === 'TerrorismOrViolentExtremism') {
167-
$form.find('.terrorism-or-violent-extremism').show();
168-
} else {
169-
$form.find('.terrorism-or-violent-extremism').hide();
170-
}
171-
172194
if (val === 'ImminentHarm') {
173195
$form.find('.imminent-harm').show();
174196
} else {
175197
$form.find('.imminent-harm').hide();
176198
}
177199
178-
if (val === 'RevengePorn') {
179-
$form.find('.revenge-porn').show();
180-
} else {
181-
$form.find('.revenge-porn').hide();
182-
}
183-
184200
if (val == 'ViolatesALicenseIOwn') {
185201
$form.find('.infringement-claim-requirements').show();
186202
$('#Signature').rules("add", {

‎src/NuGetGallery/Views/Users/ForgotPassword.cshtml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,14 @@
3333
@Html.ShowValidationMessagesForEmpty()
3434
</div>
3535
<div class="form-group">
36-
<input type="submit" class="btn btn-primary form-control" value="Send" />
36+
<input id="Submit" type="submit" class="btn btn-primary form-control" value="Send" />
3737
</div>
3838
}
3939
</div>
4040
</div>
4141
</div>
42-
</section>
42+
</section>
43+
44+
@section BottomScripts {
45+
@ViewHelpers.RecaptchaScripts(Config.Current.ReCaptchaPublicKey, "Submit")
46+
}

‎tests/NuGetGallery.Facts/Infrastructure/Authentication/ApiKeyV4Facts.cs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,10 @@ public void CreatesAValidApiKey()
3535
[InlineData(" ")]
3636
[InlineData("abc")]
3737
[InlineData("SEMTXET5UU6UZDD4AMK57TR46I==")]
38+
[InlineData("0000thisis46charactersbutnotvalidbase32encoded")]
3839
public void TryParseFailsForIllegalApiKeys(string inputApiKey)
3940
{
40-
// Act
41+
// Act
4142
bool result = ApiKeyV4.TryParse(inputApiKey, out var apiKey);
4243

4344
// Assert

0 commit comments

Comments
 (0)